App Privacy Policy

Who is responsible for your data

Your organisation decides who can use the app and what work is recorded in it. For the audits, actions, comments and files in your organisation's workspace, your organisation is the controller and we process that information on its behalf under our agreement with it. We are the controller for the information we need to run the service itself, such as sign-in and security records.

What we collect

• Account details: your name, email address, phone number (if your organisation has added one), job title or designation, and the organisation and projects you belong to. The app shows these on your profile.
• Sign-in information: your email address and password, the one-time code we email you each time you sign in, and an authenticator or backup code if your account has one. The app also lets you reset or change your password. Passwords are stored only as a secure hash.
• Content you create: audit answers and commentary, corrective actions, updates you post, responses to review comments, and the history of these changes.
• Files you add: photos and documents you attach as evidence. The app uses your camera, photo library or files only when you choose to add evidence.
• Device and technical data: a device identifier and push notification token, the device name and model, operating system and app version, and your IP address and request logs.

The app does not collect your location, contacts or advertising identifier. It contains no advertising and no third-party analytics or tracking.

How we use it

We use this information only to provide the service to your organisation:

• to sign you in and keep your account secure;
• to show, save and sync your audits, actions and evidence with the Origin Zero platform;
• to send you notifications about work assigned to you, reviews and due dates;
• to investigate problems, prevent misuse and meet our legal obligations.

We do not sell personal information, use it for advertising, or use it to train AI models. We do not use it for automated decision-making that produces legal or similarly significant effects.

Legal basis

We process this information to perform our agreement with your organisation and, for security, troubleshooting and service improvement, on the basis of our legitimate interests. Where your organisation is the controller, it is responsible for its own legal basis.

Who we share it with

We share personal information only with service providers that process it on our behalf, under contracts that restrict their use of it:

• Amazon Web Services: hosting, storage of your data and files, and sending the emails with your sign-in codes.
• Cloudflare: network security and delivery of traffic to our service.
• Google Firebase Cloud Messaging, and Apple Push Notification service on iOS: delivery of notifications to your device. They receive your device's push token and the notification text.

People in your organisation can see the work you record in the app according to the roles and permissions your administrator sets. We may also disclose information where the law requires it.

Where your data is stored

Your data and the files you add are stored and processed with Amazon Web Services in the United Kingdom, with encrypted backups in the European Union. Notification delivery providers may process limited data outside the UK; where that happens we rely on appropriate safeguards such as adequacy decisions or standard contractual clauses.

How long we keep it

We keep account information and the work you record for as long as your organisation uses the service and your account is active, or as set out in our agreement with your organisation. When an account or an organisation's service ends, we delete or anonymise its data, except where we must keep records for legal, security or audit purposes. Technical logs are kept for shorter periods.

Security

Data is encrypted in transit and at rest. Every sign-in needs your password and a one-time code, and access inside your organisation follows the roles and permissions set by your administrator.

Your rights and deleting your account

Depending on your location, you have rights to access, correct, delete or restrict the use of your personal information, to object to processing and to data portability. Because your account belongs to your organisation, you can ask your administrator, or contact us at privacy@originzero.ai from the email address you sign in with.

To delete your account and its personal data, send the same request; we will confirm it with your organisation and complete it within 30 days.

If you are in the UK you may also complain to the Information Commissioner's Office (ico.org.uk); if you are in the EEA, to your local supervisory authority.

Children

The app is a business tool for adults and is not intended for anyone under 18.

Changes and contact

We may update this policy from time to time; the date above shows the latest version. Questions about this policy or how the app handles your information: privacy@originzero.ai.